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Abstract. Quantum key distribution (QKD) refers to specific quantum strategies which permit 
the secure distribution of a secret key between two parties that wish to communicate secretly. 
Quantum cryptography has proven unconditionally secure in ideal scenarios and has been suc- 
cessfully implemented using quantum states with finite (discrete) as well as infinite (continuous) 
degrees of freedom. Here, we analyze the efficiency of QKD protocols that use as a resource 
entangled gaussian states and gaussian operations only. In this framework, it has already been 
shown that QKD is possible [T] but the issue of its efficiency has not been considered. We propose 
a figure of merit (the efficiency E) to quantify the number of classical correlated bits that can be 
used to distill a key from a sample of TV entangled states. We relate the efficiency of the protocol 
to the entanglement and purity of the states shared between the parties. 



1. Introduction 

Quantum cryptography relies on the possibility of establishing a secret random 
key between two distant parties traditionally denoted as Alice and Bob. If the key 
is securely distributed, the algorithms used to encode and decode any message can 
be made public without compromising security. The key consists typically in a 
random sequence of bits which both, Alice and Bob, share as a string of classi- 
cally correlated data. The superiority of quantum cryptography comes from the 
fact that the laws of quantum mechanics permit to the legitimate users (Alice and 
Bob) to infer if an eavesdropper has monitored the distribution of the key and has 
gained information about it. If this is the case, Alice and Bob will both agree in 
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withdrawing the key and will start the distribution of a new one. In contrast, clas- 
sical key distribution, no matter how difficult the distribution from a technological 
point of view is, can always be intercepted by an eavesdropper without Alice and 
Bob realizing it. In quantum cryptography, there exist several protocols that Alice 
and Bob can use in order to establish a secret key. Some of them, like Ekert91 [2], 
use as a resource shared entanglement between the two parties, while in others, 
like BB84 [3], the key is established by sending non entangled quantum states 
between the parties and communicating classically. If Alice and Bob share a col- 
lection of distillable entangled states, they can always obtain from them a smaller 
number of maximally entangled states from which they can establish a secure key 
[3]. The number of singlets (maximally entangled states) that can be extracted 
from a quantum state using only Local Operations and Classical Communication 
(LOCC) is referred to as the Entanglement of Distillation Ed- For establishing 
a key, another important concept is the number of secret bits Kd, that can be 
extracted from a quantum state using LOCC. Since a secret bit can always be 
extracted from a maximally entangled state, Ed < Kd- There exist also quantum 
states which are entangled but cannot be distilled, i.e., have Ed = 0. They are 
usually referred to as bound entangled states since its entanglement is bound to 
the state. Nevertheless, for some of those states it has been shown that Kd ^ 0, 
and thus, they can be used to establish a secret key [5]. 

A particular case of states that cannot be "distilled" by "normal" procedures 
are continuous variables gaussian states, e.g., thermal, coherent, and squeezed 
states of light. By "normal" procedures we mean operations that preserve the 
gaussian character of the state (gaussian operations). They correspond e.g., to 
beam splitters, squeezers, mirrors, etc. Thus, in the gaussian scenario all entangled 
gaussian states posses bound entanglement. Quantum cryptography with gaussian 
states using gaussian operations has been experimentally implemented using "pre- 
pare and measure schemes" with either squeezed or coherent states [61 [7] . Those 
schemes do not demand entanglement between the parties. 

Recently, Navascues et al. [1] have shown that it is also possible with only 
gaussian operations to extract a secret key a la Ekert91 from entangled gaussian 
states, in spite the fact that these states are not gaussian distillable. In other 
words, it has been shown that in the gaussian scenario all entangled gaussian 
states fulfill GKd > (where the letter G stands for gaussian) while GEd = 0. 
Alice and Bob can extract a list of classically correlated bits from a set a of 1 x 1 
entangled modes as follows: i) they agree on a value xq > 0, ii) Alice (Bob) 
measures the quadrature of each of her (his) modes Xa(Xb), iii) they accept only 
outputs such that \xa\ = \xb\ = xo, iv) they associate e.g., the classical value 
0(1) to Xi = +xo(—xo), i = A,B and thus establish a list of classically correlated 
bits. From there, they can apply Advantage Distillation [8] to establish the secret 
key. This protocol is secure against individual eavesdropper attacks. Since the 
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protocol is based on output coincidences of the measurements of the quadratures 
which, by definition, are operators with a continuous spectrum, the protocol has 
zero efficiency PQ. 

Here, we study the consequences of relaxing the above condition to a more 
realistic scenario. We assume that Alice and Bob can extract a list of sufficiently 
correlated classical bits obtained by accepting measurement outputs that do not 
coincide but are bound within a range. We ask ourselves which is the possibility 
that Alice and Bob can still distribute the key in a secure way under individual 
and coherent attacks. We obtain that there exists always a finite interval for which 
the protocol can be implemented successfully. The length of this interval depends 
on the entanglement and on the purity of the shared states, and increases with 
increasing entanglement. 

The paper is organised as follows. In Sect. 2, we present the formalism needed 
to tackle this problem. In Sect. 3, we first review the previous protocol [T] and 
present our new results. Finally, we present our conclusions in Sect. 4. 



2. Formalism 

Systems of continuous variables are often expressed in terms of modes, where 
each mode has two associated canonical degrees of freedom ( "position" and "mo- 
mentum") which fulfill the canonical commutation relations (CCR). The CCR for 
a quantum system with n modes can be compactly expressed via the symplectic 
matrix. Denoting the canonical coordinates by 

R- T = (91, Pi, • • -,Qn,Pn) = (Rl, ■ ■ -jRzn), 
the CCR simply read [B4, Rj] = i(J n )ij, where i,j = 1, . . . ,2n and 

t=i v j 

The symplectic matrix J defines the symplectic scalar product and describes the 
geometry of the phase space. There is a bijective map between a quantum state 
described by a density matrix p (in an infinite Hilbert space) and its corresponding 
characteristic function xp-, which is given by the Fourier- Weyl transform: 

Xp(C)=tT{pW (c) }, (2) 

^(2^/ d2n CXp(C)^(-C)> (3) 

where £ £ M. 2n and W$ = e 1 ^ JnR are the so-called Weyl operators. Gaussian 
states are characterized by a gaussian xp function, 

Xp {C) = e iC T -Jn-d-IC T J^-TJnC ) ( 4) 
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where d is a 2n real vector, called displacement vector (DV), and 7 is a 2n x In 
symmetric real matrix, denoted as covariance matrix (CM). A convenient represen- 
tation of gaussian quantum states is given in terms of the Wigner quasi-distribution 
function W p [9j, which is related to the characteristic function by the symplectic 
Fourier transform which preserves the gaussian character, 



(5) 
(6) 



where 77 6 M 2 ™. Thus, a gaussian quantum state can equivalently be defined as a 
quantum state whose Wigner function is gaussian, 



Wp(C) = - * 

7r ri V c iet7 



e -(C-d) T -l.(C-d)^ 



(7) 



d and 7 are defined as: 



d t = tv(pRi), (8) 
jij = tv(p{Ri - dil, Rj - djl}), (9) 
and are computed via the first and second moments of the characteristic function, 



d\ = -i^X>(0 



C=o 



13 + d\d! 3 



(-i) 2 



d 2 



Xp(C) 



1 



(10) 



(11) 



C=o 



where R\ = JijRj, d\ = Jijdj and 7^ = J^jklJlj- 

In analogy with classical probability theory, the displacement vector d plays 
the role of the mean value /i, = E[acf] 3 and the covariance matrix elements 7 
play the role of the covariances = Cov(xj, Xj) = E[(aij — Hi)(xj — fj,j)] of 
a classical probability distribution. So only relative displacement vectors have 
physical meaning and only the non block-diagonal terms of the covariance matrix 
tell us about the quantum correlations present in the state. 

Since the density matrix is a semidefinite positive operator, p > 0, the cor- 
responding covariance matrix must fulfill: 7 + iJ ra > 0. One can also define the 
fidelity between continuous gaussian states in terms of Wigner functions. We use 
here the Bures-Uhlmann fidelity between two arbitrary states pi and p2 defined as 

m 

1 2 



tr 



P1P2* 



[Author and title] 



5 



which coincides with the so called Hilbert-Schmidt fidelity 

F(fa,P2)=\x{piP2), (12) 

whenever at least one of the states is pure. At the level of CM, using the Quantum 
Parseval relation [11], the Hilbert-Schmidt fidelity between two gaussian states can 
be written as: 

HPuh) = (27r) n / d 2 ™cWi(C)w 2 (C) = 

= 1 p -( d2 -dQr.(_j._). (dii _ dl) (13) 

^det (^) 

where 7i(2) an d d-i(2) belong to Pi(2)- Clearly, only relative DVs are of physical 
significance. The purity of the state translates to V("f) = tr(p 2 ) = det^) -1 / 2 < 1. 
It is important to notice that gaussian states always admit a purification. Thus, 
any mixed gaussian state of n modes can be expressed as the reduction of a pure 
gaussian state of 2n modes of the form: 

72n = ( 7iT a ™()t) j C n = J ' n yJ ' - (J „7 n ) 2 - I0 n , 6 n = (T) 0, 

a n~ n °n/ ■ 

such that the mixed state can be obtained after tracing out n modes from 7 2 n- Here 
6 = ( J _°i ) , which is the momentum reflection in phase-space, is the associated 
symplectic operation. 

For what follows it is also important to study entanglement properties in the 
formalism of covariance matrices. A necessary and sufficient condition for separa- 
bility for an arbitrary bipartite state is given in [12] . For the case lxl and 1 x N 
modes a necessary and sufficient condition for separability is provided by the PPT 
criterion [13] (for the rest of the states this criterion is only necessary but not 
sufficient). The PPT criterion tells us that a state is entangled if and only if the 
state p has non positive partial transposition (NPPT): p T - A < 0. In terms of CMs 
this criterion reads 6^0^ + 1 J < 0. The second property, particularly relevant in 
what follows, is that any NPPT gaussian state can be mapped by Gaussian Local 
Operations and Classical Communication (GLOCC) to an NPPT symmetric state 
of 1 x 1 modes. 

To quantify the entanglement of our states, we will use the logarithmic nega- 
tivity as entanglement measure; LN(p) = log 2 ||/5 Ta ||i, where ||-A||i = tr\/ A^A can 
be easily computed through the sum of the singular values of A. One can extend 
this measure to gaussian states of n modes through [14]: 



n 

LN (7n) = - Yl l0g 2 mill (/^> !) 

i=l 



(14) 
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where {i/ti} = spec(— i J„7^ A ) i.e., the symplectic spectrum of the partial trans- 
posed CM. 

With this formalism at hand we now move to the presentation of our calcula- 
tions and results. 



First, we summarize the main steps of the protocol used in pQ. Without loosing 
generality, and by virtue of the properties of gaussian states, one should only 
consider the case in which Alice and Bob share many copies of a quantum system 
of 1 x 1 symmetric NPPT gaussian state pab- To extract a list of classically 
correlated bits to establish a secret key, each party measures the quadratures of 
her/his mode Xa,b and accepts only those outputs xa,b for which both parties 
have a consistent result \xa\ = \xb\ = xq. With probability p(i,j), each party 
associates the classical bit % = 0(1) to her/his outcome +xo(— xq). The probability 
that their symbols do not coincide is given by €ab = (Sj=<y j))/(Yli j P(*> ■?))• 
Having fixed a string of N classical correlated values, they can apply classical 
advantage distillation [8]. To this aim, Alice generates a random bit b and encodes 
her string of N classical bits into a vector b of length N such that bAi+bi = b mod 2. 
Bob checks that for his symbols all results bs% + b{ = b' mod 2 are consistent, and 
in this case accepts the bit b. The new error probability is given by 



which tends to zero for sufficiently large N. The most general scenario for eaves- 
dropping is to assume that Eve has access to the states before their distribution. 
Hence, the states that Alice and Bob share correspond to the reduction of a pure 4- 
mode state. Now security with respect to individual attacks from the eavesdropper 
Eve, can be established if 



where |e±±) denotes the state of Eve once Alice and Bob have projected their 
states onto | ± xq). Notice that Eve can gain information if the overlap between 
her states after Alice and Bob have measured coincident results is sufficiently small. 
The above inequalities come from the fact that in the case of individual attacks 
the error on Eve's estimation of the final bit b is bound from below by a term 
proportional to |(e++|e }\ N [lj. Therefore, Alice and Bob can establish a key if 



3. 



Results 




(15) 




(16) 



£ab 



< |(e++|e__)|. 



(17) 
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In pQ it was shown that any lxl NPPT state fulfills the above inequality and 
thus any NPPT gaussian state can be used to establish a secure key in front of 
individual eavesdropper attacks. 

Let us now present our results. Notice that since security relies on the fact that 
Alice and Bob have better correlations than the information the eavesdropper can 
learn about their state, perfect correlation is not a requirement to establish a secure 
key. We denote Alice's outputs by xqa and we calculate which are the outputs 
Bob can accept so that the correlation established between Alice and Bob outputs 
can be used to extract a secret bit. 

We use the standard form of a bipartite lxl mode gaussian state, 



1AB 



(X A 


\0 





Xa 






X B 




\ 

— c 



x B J 



(18) 



with Xa,b > 0, and c x > c p > (we can shift the DV to 0). The gaussian state is 
called symmetric if A^ = Xb = X and fully symmetric if also c x = c p . We shall deal 
with mixed symmetric states. The positivity condition reads (A — c x )(X + c p ) > 1, 
while the entanglement NPPT condition is given by (A — c x ){\ — c p ) < 1. As in 
PQ, we impose that the global state including Eve is pure (she has access to all 
degrees of freedom outside Alice an Bob) while the mixed symmetric state, shared 
by Alice and Bob is just its reduction, 



( JAB C 



(19) 



C = J A b\J '-(JabIab) 2 - h Oab 



where 



0ab = e A 



x 



Jab 



( 


-X 







-X 





-Y 








-Y 





-X 


V-Y 





-X 


o / 


l = J A 


© Jb, 







\/ a + b + y/c 



(20) 



(21) 



Y 



yfa + b — y 1 a — b 



and a = A 2 — c x c p — 1,6 = X(c x — c p ). 

Performing a measurement with uncertainty cr, the probability that Alice finds 
±|xoa| while Bob finds ±|xob| ; is given by the overlap between the state of Al- 
ice and Bob, pab, and a pure product state f>A,i ® Pbj (with i,j = 0,1) of 



[Author and title] 



gaussians centered at ±|xoa| (±1^08 1) respectively with a width (notice pA,o = 
I + I^oaIX+I^oaH)- We use here the Hilbert-Schmidt fidelity which leads to: 



p(0, 0) = p(l, 1) = tr[p AB (p Afi ® pBfl)} = 

= (2tt) 4 | ^Cab^p AB (Cab)^ pa ^p b ,o(Cab) = 
' 2\x a\\x b\c x - (A + cf 2 ){xI a + xl B ) 



(22) 



= K{a) exp 



(A + ct2)2- C 2 



for the probability that their symbols do coincide and, 

-2\x a\\xob\c x - (A + o- 2 )(xq A + xl B ) 



p(0,l) =p(l,0)=K(a)exp 



(X + a 

for the probability that they do not coincide, where 



2 ,2 _ c 2 



The error probability for a — > reads 



(23) 



(24) 



€ab = lim 



(25) 



Let us calculate the state of Eve \e±±) after Alice has projected onto | ± |xoa|) 
and Bob onto | ± |xq_b|): 



7++ = 7— 



7.T 







% 
( 



i ' 



A Ca; 

Cx A 



d±± = =F 








A5x - BAx 
\A5x + BAxqJ 



(26) 



(27) 



where A = B = Ax = |xob| - \x 0A \ and 5x = \x 0B \ + \x 0A \- The 

overlap between the two states of Eve is given by: 



l(e++|e— 



exp 



A2- C 2 



ill I ,y>-^ 

X 0A x 0i.' \ ^2 _ c 2 



1)A+ 



+ |xoa||x 0j b| (cx - c p (A 2 - c 2 ,)) 



(28) 
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Substituting Eqs. ([25]) and (f28|) into (fT7|) one can check, after some algebra, that 
the inequality (fT7|) reduces to: 

x2 ° A+ 2 X ^ (A 2 -cl- 1)A + |xoa||xo B | (-c, - c p (A 2 - c 2 )) < 0. (29) 

Notice that condition (|29[) imposes both, restrictions on the parameters defining 
the state (A, c x ,c p ), and on the outcomes of the measurements (xoa,%ob)- The 
constraints on the state parameters are equivalent to demand that the state is 
NPPT and satisfies 

(X-c x )(X + c x ) > 1. (30) 

Nevertheless, as c x > c p , any positive state fulfills this condition. Hence for any 
NPPT symmetric state, there exists, for a given xqa, a range of values of xqb such 
that secret bits can be extracted (Eq. (fT?]) is fulfilled). This range is given by 

2 2 



Ax = \xqb\ - \x a\ G 2), 
where 



a 



A 



+ A 



— y/a — 1 ' — 1 

1- (X + c x )(X + c p ) 



\xqa\, (31) 



(32) 



1 - (A - c x )(X - c p ) 

After Alice communicates \xoa\ to Bob, he will accept only measurement outputs 
within the above interval. The interval Axo is well defined if a > 1, which equivals 
to fulfill Eq. (|30p . Notice also that the interval is not symmetric around \xqa\ 
because the probabilities calculated in Eqs. ([22]) and ([23]) do depend on this value 
in a non symmetric way. The length of the interval of valid measurements outputs 
for Bob is given by 

n 4 V / " i i /qq\ 

D a = -\xqa\- (33) 

a — 1 

It can be observed that maximal D a — * oo (a = 1) corresponds to the case when 
Alice and Bob share a pure state (Eve is disentangled from the system) and thus 
condition (|17p is always fulfilled. On the other hand, any mixed NPPT symmetric 
state (a > 1) admits a finite D a . This ensures a finite efficiency on establishing a 
secure secret key in front of individual attacks. 

If we assume that Eve performs more powerful attacks, namely finite coherent 
attacks, then security is only guaranteed if pQ: 

<U; <|( e++ |e->| 2 . (34) 



1 - CAB 

This condition is more restrictive than (|17p . With a similar calculation as before 
we obtain that now security is not guaranteed for all mixed entangled symmetric 
NPPT states, but only for those that also satisfy: 

A-(A + Ca; )(A-c x )(A-c p ) >0. (35) 
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For such states, and given a measurement result xqa of Alice, Bob will only accept 
outputs within the range: 



Ax = \x 0B \ - \x 0A \ S Dp 

where 



VP-i'VP-i 



\xqa\, (36) 



2A(A 2 - cl - 1) 
P X -(X + c x )(X-c x )(X-c p ) ~ ■ { 1 

Eqs. (|30l) and ([35]) already guarantee that /3 > 1. 

Let us now focus on the efficiency issue. We define the efficiency E{^ab) of the 
protocol for a given state jab , as the average probability of obtaining a classically 
correlated bit. Explicitly, 

E(jAB) = / dxoAdXQB(l - eAB)tT(p A B\xoA,XoB)(xoA,XoB\)- (38) 

The marginal distribution in phase-space is easily computed by integrating the 
corresponding Wigner function in momentum space |15j : 



tr(p A B\xoA, x b)(xoa, x b\) = J J dp A dp B yVp AB {CAB) 



TT^A 2 " C 2 



"x 



but the final expression of f|38[) has to be calculated numerically. Note that if 
Alice and Bob share as a resource N identical states (NPPT states for individual 
attacks, and NPPT states fulfilling (|35p for finite coherent attacks), the number 
of classically correlated bits that can be extracted from them is ~ iV x E{^ab )• 
The efficiency (|38]1 increases with increasing D and decreasing €ab- I n particular, 
for the protocol given in [T], D = 0, and therefore E(jab) = for any state. 

We investigate now the dependence of E(^ab) on the entanglement of the 
NPPT mixed symmetric state used for the protocol as well as on the purity of the 
state. As a measure of the entanglement between Alice and Bob we compute the 
logarithmic negativity 

miAB) = log 2 ( 7= * = ) > 0. (40) 

In Fig. [H we display the efficiency of the protocol (assuming individual attacks) 
versus entanglement shared between Alice and Bob for different states jab- There 
is not a one-to-one correspondence between E(jab) and entanglement, since states 
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Fig. 1: Protocol efficiency (quantified by E{^ab)) versus the entanglement mea- 
sured by logarithmic negativity LN(7^s). The shading from black to white corre- 
sponds to purities from zero to one. 

with the same entanglement can have different purity, which can lead to different 
efficiency. This is so because there are two favorable scenarios to fulfill ()1T[) . The 
first one is to demand large correlations so that the relative error cab of Alice and 
Bob is small. The second scenario happens when Alice and Bob share a state with 
high purity, i.e., Eve is very disentangled. In this case, independently of the error 
cab-: CH 7 ]) can be fulfilled more easily. 

Despite the fact that efficiency generally increases with increasing entangle- 
ment, this enhancement, as depicted in the figure, is a complex function of the 
parameters involved. Nevertheless, one can see that there exist an entanglement 
threshold (around LN^ab) — 0.2) below which the protocol efficiency diminishes 
drastically no matter how mixed are the states shared between Alice and Bob. 

It is also illustrative to examine the dependence of a (which determines the 
interval length D a ) on the entanglement of the states shared by Alice and Bob. 
In Fig. [2] we plot the logarithmic negativity of a given state versus the parameter 
a. States with the same entanglement but different purity are associated to quite 
different values of a. Nevertheless states with high entanglement permit a large 
interval length (small a) and, thus, high efficiency. 

In both, Fig. Q] and Fig. [21 we have observed that states with different en- 
tanglement give the same efficiency. However it is important to point out that 
to extract the key's bits, classical advantage distillation [8] stills needs to be per- 
formed. The efficiency of Maurer's protocol, strongly increases with decreasing 
€ab, and, therefore, the states with higher entanglement will provide a higher key 
rate. 
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1.75 




10 20 30 

«(7ab) 



Fig. 2: Entanglement of the states shared between Alice and Bob measured in 
terms of the logarithmic negativity LN(7ab) versus the parameter (x(jab) under 
individual attacks. The shading from black to white corresponds to purities from 
zero to one. 

4. Conclusions 

Efficiency is a key issue for any experimental implementation of quantum cryp- 
tography since available resources are not unlimited. Here, we have shown that 
the sharing of entangled gaussian variables and the use of only gaussian operations 
permits efficient quantum key distribution against individual and finite coherent 
attacks. All mixed NPPT symmetric states can be used to extract secret bits 
under individual attacks whereas under finite coherent attacks and additional con- 
dition has to be fulfilled. We have introduced a figure of merit (the efficiency 
E) to quantify the number of classical correlated bits that can be use to distill a 
key from a sample of N entangled states. We have observed that this quantity 
grows with the entanglement shared between Alice and Bob. This relation it is 
not one-to-one due to the fact that states with less entanglement but purer (Eve 
more disentangled) can be equally efficient. Nevertheless as we have pointed out, 
these states would be, inefficient in the distillation of the key. Finally, we would 
like to remark that our study is not restricted to quantum key distribution proto- 
cols, but can be extended to any other protocol that uses as a resource entangled 
continuous variable states to establish a set of classically correlated bits between 
distant parties |16j . 
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